PA Annual Report 2014-2015 - AECL...AECL 2014-2015 PA Annual Report Final 2. STRUCTURE OF THE ACCESS TO INFORMATION AND PRIVACY OFFICE (ATIPO) AECL, together with its wholly own subsidiary,

PA Annual Report 2014-2015

Report on the Administration of the Privacy Act

Access to Information and Privacy Office

Final

2015 May

UNRESTRICTED

mai 2015

ILLIMITÉ

© Atomic Energy of Canada

Limited © Énergie atomique du Canada limitée

112 Kent Street, Suite 501 Ottawa, Ontario K1A 0S4

112, rue Kent, bureau 501 Ottawa (Ontario) K1A 0S4

Revision History Liste de révisions UNRESTRICTED

ILLIMITÉ Page 1 of /de 1

Document No. / Numéro de document:

Doc. Collection ID ID de la collection de doc.

SI Répertoire du sujet

Section Serial No. No de série

Document Details / Détails sur le document

Title Titre

Total no. of pages

Nbre total de pages

2014-2015 Annual Report on the Administration of the Privacy Act 27

For Release Information, refer to the Document Transmittal Sheet accompanying this document. / Pour des renseignements portant sur la diffusion, consultez la feuille de transmission de documents ci-jointe.

Revision History / Liste de révisions

Revision / Révision

Details of Rev. / Détails de la rév. Prepared by Rédigé par

Reviewed by Examiné par

Approved by Approuvé par

No./No Date

(yyyy/mm/dd)

AECL 2014-2015 PA Annual Report Final

D1

D1

D1

Final

2015/05/19

2015/05/20

2015/05/21

2015/05/26

Prepared First Draft – English and French copies Reviewed by ATIP Director Draft copy sent to NRCan, Portfolio Management Office Approval

Isabelle Gaudreault

Jean Boulais Maggie Saunders

Grant Gardiner

Final Final Sent to Minister for tabling

NRCan

UNRESTRICTED

Page 1


TableofContents

1. INTRODUCTION ...................................................................................................2

2. STRUCTURE OF THE ACCESS TO INFORMATION AND PRIVACY OFFICE (ATIPO) ..................................................................................5

2.1 ATIPO’s Organizational Chart ................................................................................6 2.2 Responsibilities of the ATIPO .................................................................................6 2.2.1 Processing Procedures .......................................................................................6

3. DELEGATION ORDER .........................................................................................7

3.1 Sections of the Privacy Act (PA) Authority .............................................................7 3.2 PA Delegation Order ................................................................................................8

4. 2014-2015 STATISTICAL DATA ON THE PA ..................................................11

4.1 Interpretation of the 2014-2015 Statistical Report on the PA ................................18 4.1.1 Part 1 – Requests under the PA ........................................................................18 4.1.2 Part 2 – Requests Closed During the Reporting Period ...................................18 4.1.3 Part 3 – Disclosures under Subsections 8(2) and 8(5) .....................................19 4.1.4 Part 4 – Requests for Correction of Personal Information and

Notations ..........................................................................................................19 4.1.5 Part 5 – Extensions...........................................................................................19 4.1.6 Part 6 – Consultations Received from Other Institutions and

Organizations ...................................................................................................19 4.1.7 Part 7 – Completion Time of Consultations on Cabinet

Confidences......................................................................................................20 4.1.8 Part 8 – Complaints and Investigations Notices Received ..............................20 4.1.9 Part 9 – Privacy Impact Assessments (PIAs) ...................................................20 4.1.10 Part 10 – Resources Related to the PA .............................................................20 4.2 Multi-Year Trends .................................................................................................21

5. TRAINING AND AWARENESS .........................................................................22

6. INSITUTION-SPECIFIC POLICIES, GUIDELINES AND PROCEDURES......................................................................................................22

7. COMPLAINTS, INVESTIGATIONS AND AUDITS ..........................................23

8. MONITORING PROCESSING TIME ..................................................................23

9. PRIVACY BREACHES ........................................................................................23

10. PRIVACY IMPACT ASSESSMENT ...................................................................23

11. DISCLOSURES PURSUANT TO PARAGRAPH 8(2)(M) .................................24

UNRESTRICTED

Page 2


1. INTRODUCTION

Atomic Energy of Canada Limited (AECL) is an agent Crown corporation reporting to Parliament through the Minister of Natural Resources Canada (NRCan). The mandate for AECL flows from the powers given to the Minister of NRCan under the Nuclear Energy Act:

To undertake research with respect to nuclear energy To cause nuclear energy to be utilized To license, sell or otherwise dispose of discoveries and inventions relating to nuclear

energy Going forward, the Government of Canada (GoC) is restructuring AECL. The GoC completed Phase 1 of AECL restructuring in October 2011 with the divestiture of AECL’s Commercial Operations business to Candu Energy Inc., a wholly-owned subsidiary of SNC-Lavalin. With Phase 1 of restructuring complete, AECL’s headquarters were transferred from Mississauga to Chalk River, both in Ontario. In February 2013, the GoC announced that Phase 2 of AECL restructuring will transition the Nuclear Laboratories (NL) to a Government-owned Contractor-operated (GoCo) model, similar to models implemented in the United States and United Kingdom. The objective of this phase of restructuring is to significantly transform AECL’s NL to leverage its capabilities and resources to successfully deliver nuclear science and technology (S&T) products and services to government and third-party customers, and fulfill decommissioning and waste management needs, while containing and reducing costs and financial risks for Canadian taxpayers over time. As part of the transition, AECL transferred its primary operations to its wholly owned subsidiary, Canadian Nuclear Laboratories Ltd. (CNL) in November 2014. CNL employs approximately 3,400 employees at 12 sites across Canada, most of which are located at its Chalk River Laboratories site. AECL employs 27 people as of March 31, 2015. The GoC is now proceeding with a competitive procurement and selection of the GoCo Contractor. The GoCo contract, as well as a site operating contract with CNL, will be overseen by a re-purposed AECL Crown corporation. Completion of the GoCo procurement and award of the contract are expected to occur in 2015. Throughout this transition and beyond, the GoC and AECL have committed to ensuring that nuclear safety must not and will not be compromised. Further to the direction embodied in legislation, the GoC has provided the following future missions within the GoCo model:

Nuclear decommissioning and radioactive waste management: Support the Government in its obligation to address its nuclear legacy and historic waste liabilities.

Nuclear S&T for GoC departments: Provide nuclear S&T capabilities and services to GoC departments that rely on the NL to fulfil their mandates related to nuclear safety, security, public health and the environment.

UNRESTRICTED

Page 3


Nuclear S&T and related products and services for third-party customers: Continue to support the nuclear industry’s need for in-depth nuclear research and development and test and evaluation expertise on commercial terms.

On September 1, 2007 the Federal Accountability Act amended the Privacy Act (PA) to include AECL and its wholly owned subsidiaries. The purpose of the PA is to protect the privacy of individuals with respect to personal information about themselves held by AECL, and its wholly owned subsidiary CNL, and also provides individuals with a right to access and request correction to their information. Section 72 of the PA stipulates that, at the end of each fiscal year, the head of each Government of Canada institution must prepare for submission to Parliament an annual report on the administration of this Act within their respective institution. This annual report is prepared and tabled in accordance with section 72 of the PA. The report provides a summary of the management and activities related to the implementation of the PA within AECL and CNL for the fiscal year ending March 31, 2015.

UNRESTRICTED

Page 4


2014-2015 Highlights

AECL, including CNL, received a total of 7 new requests in 2014-2015 for personal information subject to the Privacy Act. One request was outstanding from the previous reporting period. Of the total 8 requests, 7 were completed and one new request was carried forward to the next fiscal year.

Six requests were completed within 30 days and one request was completed between 31 to

60 days. Two requests were disclosed in part, four others were disclosed in full and the last request was abandoned. A total of 673 pages were reviewed.

A new on-line course covering, in part, an awareness to the PA has been implemented during the reporting year 2014-2015. A total of 3,273 employees have completed this new mandatory on-line training. Furthermore, two PA training sessions were given to 22 employees.

AECL did not disclose any personal information pursuant to subsection 8(2)(m) of the PA. In support of the decentralized self-publishing of institutional Info Source chapters,

AECL’s Info Source Chapter can be found on AECL’s external website at http://www.aecl.ca/en/home/access-to-information-and-privacy-acts/info-source.aspx

AECL has completed one Privacy Impact Assessment during this reporting period. Summaries of completed core PIAs can be found on AECL’s external website at http://www.aecl.ca/en/home/access-to-information-and-privacy-acts/privacy-impact-assessment-summaries.aspx

UNRESTRICTED

Page 5


2. STRUCTURE OF THE ACCESS TO INFORMATION AND PRIVACY OFFICE (ATIPO)

AECL, together with its wholly own subsidiary, CNL, undertakes a series of programs, identified below, that have been established to fulfil the Corporation’s strategic outcome. These programs are aligned with and support the Government of Canada’s priorities for a clean and healthy environment; healthy Canadians; a safe and secure Canada; and an innovative and knowledge-based economy.

Nuclear Industry Capability

Ensures that the Canadian nuclear sector remains safe and productive, with access to science and technology resources to address emergent technological challenges, and that Canada maintains a strong nuclear power sector.

Nuclear Safety & Security Ensures that federal activities, regulations and policies, related to nuclear or radiological issues, are supported by the necessary expertise and facilities.

Clean, Safe Energy Involves the development of energy technologies that make a beneficial impact on Canada’s use of clean energy.

Health, Isotopes & Radiation

Ensures that Canadians experience health benefits from nuclear science and technology.

Nuclear Environmental Stewardship

Ensures that Canada’s federal nuclear sites are clean and healthy environments.

Nuclear Innovation Networks

Ensures that the Canadian science and technology communities can advance their innovation agendas through access to federal nuclear innovation infrastructure and expertise.

Mission-Ready Science & Technology Infrastructure

Ensures that scientists and engineers from AECL and its partner organizations have access to licensed facilities and services that enable nuclear innovation and production in a safe campus environment that is fully compliant with all legislation for conducting nuclear-related activities.

Internal Services Provides the business and administrative support functions andinfrastructure to enable the efficient and effective delivery of theabove programs.

To fulfill PA responsibilities, AECL established an Access to Information and Privacy Office (ATIPO) in Ottawa, Ontario. The ATIPO consists of two senior analysts along with a Director who reports directly to the Vice-President, General Counsel under the Internal Services program activity.

UNRESTRICTED

Page 6


2.1 ATIPO’s Organizational Chart

2.2 Responsibilities of the ATIPO

AECL uses the same organizational structure for the administration of the Privacy Act as the Access to Information Act. On behalf of the President & CEO, the ATIP Director and the ATIPO ensure that the Corporation meets all of its obligations under the Privacy Act and deals with all applicants fairly and consistently.

Information for a Privacy Act request is collected directly from the individual at AECL who holds that information. Approval of the application of exemptions is limited in order to protect the privacy of the applicant. The final decisions on severances, exemptions and exclusions are the responsibility of the ATIP Director.

2.2.1 Processing Procedures

The processing of Privacy Act requests is centralized at the ATIP Office in Ottawa. AECL’s ATIP Director remains accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures that enable the efficient processing of requests under the Access to Information and Privacy Acts. The Director is also responsible for related policies, systems and procedures resulting from these legislations, such as privacy protection and the collection, inventory and security of personal information banks. The Director acts as the point of contact for the Institution in dealings with the ATIP Directorate at Treasury Board Secretariat and ATIP counterparts at Government of Canada departments and agencies. The ATIPO is responsible for integrating procedures and services for the efficient administration of the Access to Information and Privacy Acts. In addition to the processing of formal and informal requests, consultations and complaints, the ATIPO also provides advice and assistance to line operations on all aspects of the legislation, and prepares statistical and status reports for senior management. All formal requests for personal information under the Privacy Act are forwarded to AECL’s ATIPO, where they are reviewed for clarity and conformity with the legislation.

Chief Transition Officer, AECL

VP, General Counsel

Director, ATIP

ATIP Senior Analyst

ATIP Senior Analyst

UNRESTRICTED

Page 7


3. DELEGATION ORDER

Section 73 of the Privacy Act authorizes the head of AECL to designate, by order, one or more officers or employees to exercise or perform any powers, duties or functions of the head of AECL that are specified in the order. Delegation is entirely at the discretion of AECL’s President & CEO. To ensure ongoing safeguarding and respect for the rights of applicants and the legislative provisions of the Privacy Act, the authority to disclose and/or exempt personal information is limited to the ATIP Director, except to approve disclosure of information in the public interest or to benefit the individual 8(2)(m)(i) and (ii).

3.1 Sections of the Privacy Act (PA) Authority

President and CEO

Section 8(2)(m)(i) and 8(2)(m)(ii)

Director, ATIPSections: 8(2)(a) to 8(2)(1), 8(5),

9(3)(a)

Sections: 14, 15, 17(2)(b), 18(2), 19(1) to 28, 33(2), 35(1) and 35(4)

Sections: 69 and 70

UNRESTRICTED

Page 8


3.2 PA Delegation Order

UNRESTRICTED

Page 9


UNRESTRICTED

Page 10


UNRESTRICTED

Page 11


4. 2014-2015 STATISTICAL DATA ON THE PA

UNRESTRICTED

Page 12


UNRESTRICTED

Page 13


UNRESTRICTED

Page 14


UNRESTRICTED

Page 15


UNRESTRICTED

Page 16


UNRESTRICTED

Page 17


UNRESTRICTED

Page 18


4.1 Interpretation of the 2014-2015 Statistical Report on the PA

4.1.1 Part 1 – Requests under the PA

AECL received 7 new requests for information under the Privacy Act and one request was carried over from the last fiscal year. Of the 8 requests, 7 were completed and one new request was carried forward to the next fiscal year.

4.1.2 Part 2 – Requests Closed During the Reporting Period

Part 2.1 – Disposition and Completion Time Of the seven requests completed in 2014-2015, six requests were completed within 30 days and one request was completed between 31 to 60 days. Two requests were disclosed in part, four others were disclosed in full and the last request was abandoned. Part 2.2 – Exemptions Where access to certain information was denied, the following exemption was invoked: Reason Incidence Personal Information obtained in confidence (s.19)

1

Personal Information (s.26) 2 Part 2.3 - Exclusions No exclusions were cited in fiscal year 2014-2015.

Part 2.4 – Format of Information Released Access to the relevant documents for the six completed requests disclosed was provided in paper format for five cases and in electronic format for one case. Part 2.5 – Complexity

Part 2.5.1 – Relevant Pages Processed and Disclosed 452 pages were processed and fully disclosed for four requests. For the two disclosed-in-part requests, 149 pages were processed and a total of 133 pages were disclosed.

Part 2.5.2 – Relevant Pages Processed and Disclosed by Size of Requests Three fully disclosed requests and one disclosed in part request had less than 100 pages processed. One request that was fully disclosed and one request that was disclosed in part had between 101 and 500 pages processed.

Part 2.5.3 – Other Complexities One processed request required consultation and none required legal advice or other complexities.

UNRESTRICTED

Page 19


Part 2.6 – Deemed Refusals

Part 2.6.1 – Reasons for not meeting statutory deadline AECL has no deemed refusal to report in the fiscal year 2014-2015.

Part 2.6.2 – Number of days past deadline AECL has no deemed refusal to report in the fiscal year 2014-2015.

Part 2.7 – Request for Translation No translations were prepared during the period under review.

4.1.3 Part 3 – Disclosures under Subsections 8(2) and 8(5)

This fiscal year, no disclosures of personal information were made pursuant to s. 8(2)(e) (investigations provision), 8(2)(f) (under an agreement or arrangement between the Government of Canada or an institution), 8(2)(g) (to a Member of Parliament) or 8(2)(m) (public interest override provision) of the Privacy Act.

4.1.4 Part 4 – Requests for Correction of Personal Information and Notations

Neither corrections nor notations were requested during the period under review.

4.1.5 Part 5 – Extensions

Part 5.1 – Reasons for extensions and disposition of requests One extension was required for consultations with another government department during the period under review. Part 5.2 – Length of extensions One extension of 16 to 30 days was required for consultations with another government department during the period under review.

4.1.6 Part 6 – Consultations Received from Other Institutions and Organizations

Part 6.1 – Consultations received from other Government of Canada institutions and other organizations No consultations were received from other institutions and organizations during the period under review.

UNRESTRICTED

Page 20


Part 6.2 – Recommendations and completion time for consultations received from other Government of Canada institutions No consultations were received from other institutions and organizations during the period under review. Part 6.3 – Recommendations and completion time for consultations received from other organizations No consultations were received from other institutions and organizations during the period under review.

4.1.7 Part 7 – Completion Time of Consultations on Cabinet Confidences

No consultations on Cabinet confidences were required during the period under review. Part 7.1 – Requests with Legal Services No consultations on Cabinet confidences were required during the period under review. Part 7.2 Requests with Privacy Council Office No consultations on Cabinet confidences were required during the period under review.

4.1.8 Part 8 – Complaints and Investigations Notices Received

AECL received no privacy complaints and no audits or investigations were concluded during the reporting period 2014-2015.

4.1.9 Part 9 – Privacy Impact Assessments (PIAs)

AECL has completed one Privacy Impact Assessment during this reporting period. More information regarding the PIA is provided in section 10 of this annual report.

4.1.10 Part 10 – Resources Related to the PA

Part 10.1 - Costs Total salary costs associated with PA activities are estimated at $210,627.00 for 2014-2015. Other operation and maintenance costs amounted to $6,857.00 for a total of $217,484.00. Part 10.2 – Human Resources The associated full-time equivalency human resource was 1.5.

UNRESTRICTED

Page 21


4.2 Multi-Year Trends

0

10

20

30

40

50

60

70

80

90

2007‐2008 2008‐2009 2009‐2010 2010‐2011 2011‐2012 2012‐2013 2013‐2014 2014‐2015

Number of Requests Received Number of Extensions applied

Exemptions invoked Completion Time of more than 30 days

UNRESTRICTED

Page 22


5. TRAINING AND AWARENESS

The Training Oversight Committee of AECL’s wholly owned subsidiary CNL, has finalized a new corporate required training curriculum for fiscal year 2014-2015. The curriculum includes the new Online Security Awareness – Information Management ODT-691D required to be completed by all employees (full time, part time, term and casual). This course includes an awareness of the Privacy Act which covers the purpose of the Act, various exemptions, the delegation of authority, the privacy request process, the protection of personal information, the right to complain, responsibilities under the Act, best practices and the need of good information management. A total of 3,273 employees have completed the online awareness during fiscal year 2014-2015. Furthermore, the office of ATIP in collaboration with CNL’s Organizational Development and Training has updated the Privacy Act Awareness course (AWS-0030) with due regards to TBS’ Directive on Privacy Requests and Correction of Personal Information. This training is to inform AECL employees of the application of the Privacy Act, including the purpose of the Act, applicable definitions, their responsibilities, the principles for assisting requesters, the delegation, exemptions decisions, the exercise of discretion, the requirement to provide complete, accurate and timely responses, the complaint process, sound privacy practices for the creation, collection, retention, validation, use, disclosure and disposition of personal information, the requirements found in TBS policy instruments and AECL’s procedures related to the administration of the Act, including policies on management of information. Briefing sessions form an integral part of the ATIP communications and training objectives. Two formal Privacy training sessions AWS-0030 were given to 22 employees and senior managers from the Canadian Nuclear Laboratories in Chalk River and the Port Hope Area Initiative Office in Port Hope. Informal briefing sessions are also given regularly by the ATIPO employees during the process of retrieval and review of documents in response to Privacy Act requests.

6. INSITUTION-SPECIFIC POLICIES, GUIDELINES AND PROCEDURES

AECL did not implement any new and/or revised institution-specific Privacy related policies, guidelines or procedures during the reporting period. Therefore, several Privacy Statements have been added to institution-specific forms collecting personal information. Additionally, AECL continuously worked to identify new collections of personal information and reviewed AECL’s Personal Information Banks (PIBs) registered with the Information and Privacy Policy Division at Treasury Board Secretariat. No new PIB update or registration were necessary during fiscal year 2014-2015.

UNRESTRICTED

Page 23


7. COMPLAINTS, INVESTIGATIONS AND AUDITS

Applicants have the right to file a complaint pursuant to the Privacy Act and may exercise this right at any time during the processing of their request. AECL received no privacy complaints, and no audits or investigations were concluded during the reporting period 2014-2015.

8. MONITORING PROCESSING TIME

AECL utilizes Privasoft software as a tool to monitor the time to process every privacy requests and requests for the correction of personal information. No other monitoring was necessary or conducted during the reporting period as 100% of the requests were completed on time.

9. PRIVACY BREACHES

No material privacy breaches occurred during the reporting period.

10. PRIVACY IMPACT ASSESSMENT

AECL completed one Privacy Impact Assessment (PIA) during this reporting period: The PIA analyzed the potential privacy risks associated with the implementation of the Perspective Application created by the company PPM. The privacy issues identified can be resolved through the development and documentation of appropriate procedures and processes that ensure compliance with the Privacy Act. The personal information collected for the purpose of investigations and incident reporting through the Perspective Application will only be used for a purpose that is compatible with the collection. The application is a highly secure system with extensive security features and procedures and can only be accessed by authorized users. The Nuclear Safety and Security program has demonstrated an ongoing commitment to the security and protection of the sensitive data. Departmental officials incorporated privacy as a core element.

The Perspective Application by PPM has not yet been approved for implementation due to the ongoing restructuring of AECL and the transition of the Nuclear Laboratories to a GoCo model. As a result, the PIA summary is currently not available to the public.

UNRESTRICTED

Page 24


11. DISCLOSURES PURSUANT TO PARAGRAPH 8(2)(M)

During this fiscal year, no disclosures of personal information were made under paragraph 8(2)(m) of the Privacy Act.

Documents

PA Annual Report 2014-2015 - AECL...AECL 2014-2015 PA Annual Report Final 2. STRUCTURE OF THE ACCESS TO INFORMATION AND PRIVACY OFFICE (ATIPO) AECL, together with its wholly own subsidiary,